IPSec IKE mode-cfg not handing out ip addresses to dialup fortigates. v7.2.10
I thought it was possible to have the Hub hand out an ip addresses via mode-cfg from the Dialup IPSec tunnel, doesn't seem to work. Is it supposed to work when a branch Fortigate dials into the Hub Fortigate.
Here are my IPSec configurations for the Hub and a Spoke.
(The tunnels are up, it's just that the spoke will not grab an IP Address or the Hub is not handing them out)

HUB:
config vpn ipsec phase1-interface
edit "advpn_1"
set type dynamic
set interface "port3"
set ike-version 2
set peertype one
set net-device disable
set mode-cfg enable
set proposal aes256-sha256
set add-route disable
set auto-discovery-sender enable
set peerid "100"
set ipv4-start-ip 172.50.100.100
set ipv4-end-ip 172.50.103.200
set ipv4-netmask 255.255.252.0
set psksecret
set dpd-retrycount 2
set dpd-retryinterval 10
next
end
-----------------------------------------------------------------
Spoke:
config vpn ipsec phase1-interface
edit "advpn_1"
set interface "wan2"
set ike-version 2
set peertype any
set net-device enable
set mode-cfg enable
set proposal aes256-sha256
set add-route disable
set localid "100"
set auto-discovery-receiver enable
set auto-discovery-shortcuts dependent
set remote-gw x.x.x.x
set psksecret
set dpd-retrycount 2
set dpd-retryinterval 10
next
end
----------------------------------------------------------------
This is what I get when I run the below on the Spoke side:
diagnose ip router bgp level info
diag ip router bgp all enable
di de en
BGP: 172.50.100.1-Outgoing [FSM] State: Active Event: 9
BGP: 172.50.100.1-Outgoing [FSM] State: Connect Event: 9
BGP: 172.50.100.1-Outgoing [NETWORK] FD=26, Sock Status: 101-Network is unreachable
BGP: 172.50.100.1-Outgoing [FSM] State: Connect Event: 18
BGP: 172.50.100.1-Outgoing [FSM] State: Active Event: 9
BGP: 172.50.100.1-Outgoing [FSM] State: Connect Event: 9
BGP: 172.50.100.1-Outgoing [NETWORK] FD=26, Sock Status: 101-Network is unreachable
BGP: 172.50.100.1-Outgoing [FSM] State: Connect Event: 18
di deBGP: 172.50.100.1-Outgoing [FSM] State: Active Event: 9
BGP: 172.50.100.1-Outgoing [FSM] State: Connect Event: 9
BGP: 172.50.100.1-Outgoing [NETWORK] FD=26, Sock Status: 101-Network is unreachable
BGP: 172.50.100.1-Outgoing [FSM] State: Connect Event: 18
This leads me to the Spoke not getting an IP from the Hub via ike mode-cfg
